Authentication

Every request to the Dependra API is authenticated with a scoped API key presented as a Bearer token. API-key principals are governed by their scopes (not membership RBAC) and carry a tenant claim that scopes every call.

Note

API & MCP access is a Business+ capability. Create keys on the Business tier and above.

Authentication method

Include your API key in the Authorization header of every request:

Authorization: Bearer dep_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Dependra API keys are prefixed with dep_. The key is shown once at creation — store it in your secrets manager. All requests must be made over HTTPS.

Base URL — tenant-scoped

Dependra API routes are scoped to your tenant id. The shape is:

https://dependra.io/api/{tenantId}/...

{tenantId} is the GUID of your organisation’s tenant. Your key already carries a tenant claim, so a key can only ever access data within its own tenant — the id in the path must match the key’s tenant.

Tip

Store the base as an environment variable, e.g. DEPENDRA_BASE=https://dependra.io/api/<your-tenant-id>, so your scripts read cleanly.

Code examples

# List applications in your tenant
curl -X GET "https://dependra.io/api/$TENANT_ID/applications" \
  -H "Authorization: Bearer $DEPENDRA_API_KEY" \
  -H "Content-Type: application/json"

const BASE = `https://dependra.io/api/${process.env.TENANT_ID}`;
const API_KEY = process.env.DEPENDRA_API_KEY;

const response = await fetch(`${BASE}/applications`, {
  headers: {
    Authorization: `Bearer ${API_KEY}`,
    'Content-Type': 'application/json',
  },
});

const applications = await response.json();
console.log(applications);

using System.Net.Http.Headers;

var tenantId = Environment.GetEnvironmentVariable("TENANT_ID");
var client = new HttpClient
{
    BaseAddress = new Uri($"https://dependra.io/api/{tenantId}/"),
};
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("DEPENDRA_API_KEY"));

var response = await client.GetAsync("applications");
Console.WriteLine(await response.Content.ReadAsStringAsync());

Scopes

Every key is issued with one or more scopes. Requests outside a key’s scopes are rejected with 403.

Scope	Grants
`read`	Read the landscape (and, where the plan/visibility allow, revenue & economics fields)
`write`	Landscape mutations — portfolio, business-model and infrastructure entities, including deletes
`health`	Push component health signals to the ingestion endpoint

Error responses

Status	Meaning
`401 Unauthorized`	Missing, invalid, or expired API key
`403 Forbidden`	Valid key, but the required scope is missing
`429 Too Many Requests`	Rate limit exceeded (e.g. health-signal ingest cap) — honour `Retry-After`
`503 Service Unavailable`	An asynchronous ingestion path is temporarily unavailable

Note

Error responses are JSON with a descriptive message. Dependra never returns stack traces or another tenant’s data in an error.

Security best practices

Never expose keys in client-side code — keys are for server-side apps, CI, and agents only.
Use environment variables or a secrets manager — store the key as DEPENDRA_API_KEY.
Scope down — issue a health-only key for monitoring integrations, read for query bots.
Rotate regularly — see the API Keys guide.

Next steps

See the API Examples page for CRUD and blast-radius examples, or the MCP quickstart to connect an AI agent.